Source-linked AI summary
FLDetector: Defending Federated Learning Against Model Poisoning Attacks via Detecting Malicious Clients
Zaixi Zhang, Xiaoyu Cao, Jinyuan Jia, Neil Zhenqiang Gong
TL;DR
FL model poisoning remains difficult when many malicious clients overwhelm defenses that tolerate only small numbers or require clean validation data. FLDetector predicts client updates from historical updates, detects inconsistency, and removes suspicious clients; experiments report strong detection across attacks and datasets, after which robust FL can learn accurate global models.
Problem
Model poisoning attacks corrupt federated global models, while existing defenses are limited against many malicious clients or depend on clean server-side validation data.
Method
FLDetector predicts each client’s update from historical updates using the Cauchy mean value theorem and L-BFGS, then detects clients whose received updates are inconsistent.
Results
Across three benchmark datasets and multiple untargeted, targeted, and adaptive attacks, FLDetector outperforms baseline detection methods in various scenarios and supports accurate robust-FL models after removal.
Takeaways & Limitations
Detecting and removing most malicious clients allows existing Byzantine-robust FL methods to learn accurate global models using the remaining clients.
Takeaways & Limitations
The adaptive-attack analysis indicates that reducing λ makes malicious clients less likely to be detected, although it also makes the attack less effective.
Abstract
from arXiv · showhide
Federated learning (FL) is vulnerable to model poisoning attacks, in which malicious clients corrupt the global model via sending manipulated model updates to the server. Existing defenses mainly rely on Byzantine-robust FL methods, which aim to learn an accurate global model even if some clients are malicious. However, they can only resist a small number of malicious clients in practice. It is still an open challenge how to defend against model poisoning attacks with a large number of malicious clients. Our FLDetector addresses this challenge via detecting malicious clients. FLDetector aims to detect and remove the majority of the malicious clients such that a Byzantine-robust FL method can learn an accurate global model using the remaining clients. Our key observation is that, in model poisoning attacks, the model updates from a client in multiple iterations are inconsistent. Therefore, FLDetector detects malicious clients via checking their model-updates consistency. Roughly speaking, the server predicts a client's model update in each iteration based on its historical model updates using the Cauchy mean value theorem and L-BFGS, and flags a client as malicious if the received model update from the client and the predicted model update are inconsistent in multiple iterations. Our extensive experiments on three benchmark datasets show that FLDetector can accurately detect malicious clients in multiple state-of-the-art model poisoning attacks. After removing the detected malicious clients, existing Byzantine-robust FL methods can learn accurate global models.Our code is available at https://github.com/zaixizhang/FLDetector.
1 INTRODUCTION
Federated learning coordinates model training without sharing local data, but malicious clients can poison the global model. FLDetector detects malicious clients through update consistency so robust FL methods can train accurately after their removal.
- Federated Learning: FL trains a shared global model by repeatedly sending it to clients, receiving local model updates, and aggregating those updates.Clients retain their local training data while participating in iterative model training.
- Threat: Model poisoning attacks let malicious clients corrupt the global model by sending manipulated updates, either broadly or for attacker-chosen inputs.Targeted attacks can preserve accuracy on other testing inputs while causing incorrect predictions on inputs with attacker-chosen triggers.
- Existing Defenses: Existing defenses are limited because they tolerate only a small number of malicious clients or require a clean, representative server-side validation dataset.Krum has a theoretical tolerance bound, while FLTrust depends on validation data whose distribution should remain close to the overall training distribution.
- FLDetector: FLDetector is an unsupervised detector that identifies malicious clients by checking consistency between their received and predicted model updates.Its intuition is that benign clients follow the FL algorithm, whereas malicious clients craft updates inconsistently across iterations.
- FLDetector: The server predicts each client’s update from historical updates using the Cauchy mean value theorem, measures Euclidean distance, and clusters dynamically updated suspicious scores with k-means and Gap statistics.Clients in the cluster with larger average suspicious scores are classified as malicious.
- Evaluation: Across three benchmark datasets and multiple poisoning attacks, FLDetector outperforms baseline detectors in broad settings, enabling robust FL methods to learn accurate models after detected clients are removed.The evaluation includes untargeted, targeted, and adaptive attacks; even when a small fraction of malicious clients is missed, the remaining robust methods can match clean-client accuracy.
2 RELATED WORK
The related work covers untargeted and targeted model poisoning attacks, followed by Byzantine-robust aggregation methods that attempt to limit their impact. It also highlights validation-data dependence in FLTrust.
- Model Poisoning Attacks: Model poisoning attacks are categorized as untargeted or targeted, with the latter also known as backdoor attacks.Targeted attacks cause attacker-chosen labels for inputs containing attacker-chosen triggers.
- Model Poisoning Attacks: The reviewed untargeted attack formulates poisoning as an optimization problem that crafts malicious updates to maximize the change in aggregated updates.The framework can target different aggregation rules, including the rule used by the server.
- Model Poisoning Attacks: Scaling Attack amplifies trigger-trained updates, DBA distributes trigger patterns across malicious clients, and A Little is Enough crops updates to evade robust aggregation.These attacks manipulate local training examples, update magnitudes, or update ranges to produce targeted effects.
- Byzantine-Robust FL Methods: Byzantine-robust FL methods treat client updates as high-dimensional vectors and robustly estimate the aggregated update.Krum selects one update using distances to nearby updates, while Trimmed-Mean and Median aggregate coordinates separately.
- Byzantine-Robust FL Methods: FLTrust scores updates by directional agreement with a server update computed from an additional validation dataset.Its performance is poor when the validation-data distribution substantially diverges from the overall training distribution.
3 PROBLEM FORMULATION
The paper formulates FL as distributed optimization over clients’ local datasets, with iterative client updates and server aggregation. Its detection goal is to remove most malicious clients early enough for robust FL to recover accurate training.
- FL Setting: The setting has n clients with local datasets D_i whose union forms the joint training data.The global model minimizes the aggregate loss over clients’ local datasets.
- FL Process: At each iteration, the server sends the current global model to clients, which compute local gradients or updates and return them.The formulation assumes one standard gradient-descent step for simplicity, while noting that clients may instead use multi-step SGD.
- FL Process: The server aggregates client updates into a global update and applies it with global learning rate α; FL methods differ mainly in their aggregation rules.The resulting model is updated iteratively from w_t to w_t+1.
- Attack Model: The attack model allows an attacker to control m fake or compromised clients while leaving the server uncompromised.The attacker knows malicious clients’ local data and updates, the loss function, and the learning rate, and can send crafted updates.
- Detection Objective: The detector uses current and historical client updates to classify clients, then stops training, removes detected malicious clients, and restarts on the remainder.The goal is to detect a majority of malicious clients as early as possible so Byzantine-robust FL can handle those that remain undetected.
4 FLDETECTOR
FLDetector predicts each client’s model update from historical global-model changes and compares it with the received update to identify inconsistent clients. It aggregates these consistency signals over time, clusters clients by suspicious score, and supports subsequent robust aggregation after removing detected clients.
- Model-Updates Consistency: FLDetector uses the Cauchy mean value theorem to relate a client’s current update to its previous update and an integrated Hessian.This relation encodes consistency between successive model updates.
- Model-Updates Consistency: L-BFGS estimates a shared Hessian approximation from recent global-model and global-model-update differences for predicting client updates.The server stores differences from the latest N iterations and computes a Hessian-vector product in the current global-model-change direction.
- Suspicious Scores: Benign clients’ predicted and received updates are consistent, whereas malicious clients’ updates are inconsistent, enabling detection through Euclidean distance.The method compares predicted and received updates for each client in each iteration.
- Suspicious Scores: Each client’s suspicious score averages normalized Euclidean distances between predicted and received updates over a window of N iterations.Normalization incorporates consistency variations across iterations before averaging the distances.
- Unsupervised Detection: Gap statistics determines whether suspicious scores form multiple clusters, after which k-means classifies the higher-average cluster as malicious.When more than one cluster is identified, clients in the cluster with larger average suspicious score are classified as malicious and removed.
- Overhead and Analysis: FLDetector requires O(Np) server storage and O(N^3 + 6Np) per-iteration complexity for Hessian estimation and its Hessian-vector product.Here, p denotes the number of global-model parameters and N the window size.
5 EXPERIMENTS
Experiments evaluate FLDetector across three benchmark datasets, multiple aggregation rules, poisoning attacks, and non-IID settings. The results show strong malicious-client detection and accurate global models after detected clients are removed.
- Experimental Setup: Experiments use MNIST, CIFAR10, and FEMNIST with FedAvg, Krum, Trimmed-Mean, and Median aggregation rules.The default malicious-client fraction is 28%, corresponding to 28 malicious clients for MNIST and CIFAR10 and 84 for FEMNIST.
- Experimental Setup: Detection is evaluated with DACC, FPR, and FNR, while global-model performance uses TACC and targeted-attack ASR.Lower ASR indicates that a targeted model-poisoning attack is less successful.
- Detection Results: On FEMNIST, FLDetector’s FNR is 0.0 across attacks and aggregation rules, while its FPR ranges from 0.0 to 0.20.FLDetector outperforms VAE on FEMNIST and generally outperforms or matches it on MNIST and CIFAR10.
- Detection Results: FLDetector’s model-updates consistency and Hessian vector product generally outperform the evaluated variants for malicious-client detection.Its DACC is higher with Krum, Trimmed-Mean, and Median than with FedAvg in the reported experiments.
- Global-Model Performance: Global models trained with FLDetector are as accurate as models trained without attacks, while targeted-attack ASRs are much smaller.Byzantine-robust aggregation methods can resist the small number of malicious clients that evade detection; one example reports two missed clients on CIFAR10 with Median under A Little is Enough Attack.
- Robustness Analysis: DACC declines beyond attack-dependent thresholds, including more than 30 malicious clients for Untargeted Model Poisoning and 20 for A Little is Enough Attack.Across different malicious-client counts and non-IID degrees, models trained with FLDetector are reported as more accurate than models trained without it.
- Robustness Analysis: Periodic attacks produce corresponding suspicious-score patterns, and malicious and benign clients become well separated around the 60th iteration.Under adaptive Scaling Attack, reducing the attack scaling factor lowers DACC but leaves ASR low; DACC is robust to the evaluated window-size and sampling settings.
6 CONCLUSION AND FUTURE WORK
FLDetector detects malicious clients by checking model-update consistency, using the Cauchy mean value theorem and L-BFGS. Evaluation across benchmark datasets, attacks, and FL methods shows improved detection over baselines.
- FLDetector checks clients’ model-updates consistency to detect malicious clients.It quantifies consistency using the Cauchy mean value theorem and an L-BFGS algorithm.
- FLDetector was evaluated on three benchmark datasets, four state-of-the-art attacks, and four FL methods.
- FLDetector outperforms baseline detection methods in various scenarios.
- Future work includes vertical and asynchronous federated learning, other domains, and efficient global-model recovery after removing detected clients.
A PROOF OF THEOREM 1
The proof bounds the estimated Hessian using assumptions, positive definiteness, and the Cauchy-Schwarz inequality, then applies this bound to differences between predicted and received updates.
- The proof analyzes an inequality involving the estimated Hessian Hˆ_t for any iteration t and vector z.
- The Quasi-Hessian update is derived recursively, with the final estimated Hessian set to B_t.
- The proof derives an upper bound for z^T Hˆ_t z using the positive definiteness of B_{t−m} and the Cauchy-Schwarz inequality.
- z^T Hˆ_t z is bounded by (N + 1)L∥z∥^2.
- Theorem 1 bounds the difference between predicted and received model updates for benign and malicious clients.
- Table 4 reports DACC, FPR, and FNR for malicious-client detection on MNIST with a CNN and 28 malicious clients.
- Table 5 reports the same detection metrics on CIFAR10 using a ResNet20 global model and 28 malicious clients.
- Table 6 reports TACC and ASR for MNIST, noting that FedAvg with FLDetector remains vulnerable because FedAvg is not Byzantine-robust.